Vulnerabilities > Oracle > VM Server > Medium

DATE CVE VULNERABILITY TITLE RISK
2017-01-27 CVE-2017-3242 Improper Input Validation vulnerability in Oracle VM Server 3.2/3.4
Vulnerability in the Oracle VM Server for Sparc component of Oracle Sun Systems Products Suite (subcomponent: LDOM Manager).
local
low complexity
oracle CWE-20
5.9
2016-08-06 CVE-2016-6198 Improper Access Control vulnerability in multiple products
The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c.
local
low complexity
linux oracle CWE-284
5.5
2016-08-06 CVE-2016-6197 Improper Input Validation vulnerability in multiple products
fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink.
local
low complexity
oracle linux CWE-20
5.5
2016-08-06 CVE-2016-5696 Information Exposure vulnerability in multiple products
net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.
network
high complexity
google oracle linux CWE-200
4.8
2016-08-02 CVE-2016-5403 Resource Exhaustion vulnerability in multiple products
The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.
local
low complexity
canonical oracle qemu debian redhat CWE-400
5.5
2016-06-27 CVE-2016-4470 The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.
local
low complexity
oracle linux novell redhat
5.5
2016-06-07 CVE-2016-4962 Permissions, Privileges, and Access Controls vulnerability in multiple products
The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore.
local
low complexity
oracle xen CWE-264
6.7
2016-05-11 CVE-2016-3712 Integer Overflow or Wraparound vulnerability in multiple products
Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.
5.5
2016-03-22 CVE-2016-3115 Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.
network
low complexity
openbsd oracle
6.4
2016-02-19 CVE-2016-2270 Improper Input Validation vulnerability in multiple products
Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.
network
low complexity
debian fedoraproject xen oracle CWE-20
6.8